shapeup-sdlc 1.6.2

package/skills/spec-evaluator/references/dimensions/performance.md

@@ -0,0 +1,48 @@
+---
+id: performance
+title: "Performance"
+enabled: false          # ⛔ STUB — not run until flipped true or named in --dimensions
+weight: 1.0
+hard_threshold: count<=0
+applies_to:
+  variant: [be, web]
+  package: any
+requires_browser: true
+---
+
+# Performance (stub)
+
+Not run in v0.1. Worked example only. Performance is deliberately out of scope now;
+this file documents how it would attach later without touching the core.
+
+## Criteria  (TODO — fill before enabling)
+
+```yaml
+- id: PERF-API
+  statement: "Endpoints touched by the task respond within the budget stated in the spec."
+  probe: cmd
+  evidence_required: true
+  pass_rule: "TODO: measured p95 under the spec's budget for the documented payload."
+  source: contract
+
+- id: PERF-WEB
+  statement: "The screen the task delivers meets its interaction budget (no obvious jank)."
+  probe: ui
+  evidence_required: true
+  pass_rule: "TODO: drive the screen; primary interaction completes within budget."
+  source: scope-summary
+```
+
+## Threshold
+`count<=0` — every performance criterion must meet its budget (no over-budget items
+tolerated). Tune to `count<=N` if soft budgets are acceptable.
+
+## Bug template
+```
+severity: [critical|major|minor]
+criterion: [PERF-API | PERF-WEB]
+location: <endpoint | screen>
+repro: <load / measurement performed>
+expected: <budget from spec>
+actual: <measured value>
+```

package/skills/spec-evaluator/references/dimensions/security.md

@@ -0,0 +1,60 @@
+---
+id: security
+title: "Security"
+enabled: false          # ⛔ STUB — not run until flipped true or named in --dimensions
+weight: 1.0
+hard_threshold: no-critical
+applies_to:
+  variant: [be, shared]   # backend + shared contracts; not graded on .web/.mobile tasks
+  package: any
+requires_browser: false
+---
+
+# Security (stub)
+
+Not run in v0.1. Shipped as a worked example of the dimension contract so turning it on
+later is a one-line registry change, no core edits.
+
+> The user explicitly scoped v0.1 to spec + AC correctness only. This file exists to prove
+> the injection path, not to be enabled now. Flip `enabled: true` (or pass
+> `--dimensions spec-conformance,security`) when security becomes in scope.
+
+## Criteria  (TODO — fill before enabling)
+
+```yaml
+- id: SEC-AUTHZ
+  statement: "Every endpoint touched by the task enforces the authorization rule from the spec."
+  probe: cmd
+  evidence_required: true
+  pass_rule: "TODO: unauthenticated/forbidden requests are rejected with the documented code."
+  source: contract
+
+- id: SEC-INPUT
+  statement: "Inputs are validated against the contract; malformed input is rejected, not crashed on."
+  probe: cmd
+  evidence_required: true
+  pass_rule: "TODO: fuzz the documented fields; no 500 / unhandled exception leaks."
+  source: contract
+
+- id: SEC-SECRETS
+  statement: "No secrets/keys committed in the task's changed files."
+  probe: static
+  evidence_required: true
+  pass_rule: "TODO: scan the diff for secret patterns; zero hits."
+  source: code
+```
+
+## Threshold
+`no-critical` — minor/major findings are reported but do not fail the build; any
+`critical` finding fails the dimension. (Contrast with spec-conformance's `all-pass`:
+correctness is binary, security is risk-tiered.)
+
+## Bug template
+```
+severity: [critical|major|minor]
+criterion: [SEC-AUTHZ | SEC-INPUT | SEC-SECRETS]
+location: <file:line | endpoint>
+repro: <request / scan that surfaced it>
+expected: <secure behavior per spec>
+actual: <observed weakness>
+```

package/skills/spec-evaluator/references/dimensions/spec-conformance.md

@@ -0,0 +1,134 @@
+---
+id: spec-conformance
+title: "Spec conformance"
+enabled: true
+weight: 1.0
+hard_threshold: all-pass
+applies_to:
+  lens: [lite, standard]
+  package: any
+  variant: any
+requires_browser: true
+---
+
+# Spec conformance
+
+The one dimension the evaluator runs by default. Answers a single question with no
+leniency: **does the built task do exactly what its spec and acceptance criteria say —
+no less (missing/stubbed behavior) and no more (out-of-scope changes)?**
+
+Correctness only. Not security, not performance, not aesthetics. Those are other
+dimensions, off by default.
+
+## Criteria
+
+```yaml
+- id: SC-AC
+  statement: "Every UC Step, Error Case, and (when present) Invariant/Test-Surface row for the
+    use case(s) this task/feature implements is satisfied."
+  probe: cmd          # most are cmd; [ui]/[data] criteria use those probes per GATE V1.2 classification
+  evidence_required: true
+  pass_rule: >
+    Each criterion is drawn from usecases/UC-*.md (numbered ## Steps, ## Error Cases rows,
+    ## Invariants [INV-NN] entries, ## Test Surface derived rows when present) for every UC
+    named in this task's use_case_refs (or confirmed with the user at V1.1 when no local task
+    file exists). Run each via its classified probe and PASS. Zero failing criterion.
+    A stubbed/display-only implementation that satisfies a local task file's own AC wording but
+    not the UC's actual behavior FAILS — the task's AC (if present) is a paraphrase read only
+    for traceability (GATE V0.2b), never the grading text itself.
+  source: usecases
+
+- id: SC-DONE-WHEN
+  statement: "Each 'Done when:' statement for this task (scope-summary) is satisfied."
+  probe: ui
+  evidence_required: true
+  pass_rule: >
+    Drive the running app to reproduce the user-visible outcome each Done-when describes.
+    The outcome is observed, not inferred from code. Done-when statements are honored verbatim.
+  source: scope-summary
+
+- id: SC-REQ
+  statement: "Request shape matches contracts/<repo>.contract.md #Request table."
+  probe: cmd
+  evidence_required: true
+  pass_rule: "A real request built from the contract is accepted; every field/type/required flag matches."
+  source: contract
+
+- id: SC-RES
+  statement: "Response mapping matches contracts/<repo>.contract.md #Response table."
+  probe: cmd
+  evidence_required: true
+  pass_rule: "The actual response is compared field-by-field to the Response table; all map correctly."
+  source: contract
+
+- id: SC-ERR
+  statement: "Every error code in contracts/<repo>.contract.md #Error Cases is handled."
+  probe: cmd
+  evidence_required: true
+  pass_rule: "Each error case is triggered and the documented code/shape is returned; none unhandled."
+  source: contract
+
+- id: SC-NONGO
+  statement: "The implementation respects the feature's '## Non-Go' boundary (_index.md) and
+    each touched UC's own scope."
+  probe: static
+  evidence_required: true
+  pass_rule: >
+    Inspect the diff / changed files. No file outside the feature's declared package/scope is
+    modified, and no item in _index.md's ## Non-Go list is touched. Any out-of-scope change
+    FAILS with file:line. (A local task file's own Non-Go section, when present, is consistent
+    with _index.md by construction — ba-pitch-analyzer derives it from the pitch — but the
+    committed _index.md is the grading source since the task file may not exist locally.)
+  source: index
+
+- id: SC-LAYER
+  statement: "No upward layer leak — the task does not reach above its declared layer."
+  probe: static
+  evidence_required: false   # advisory unless a concrete violation is found
+  pass_rule: >
+    A Layer-N task does not implement or depend on un-built Layer N+1 code.
+    Only FAILS if a concrete violation is observed; otherwise PASS.
+  source: code
+```
+
+Criteria applicability by variant (the core uses `applies_to` for the dimension, then
+common sense per task):
+- `SC-REQ / SC-RES / SC-ERR` apply only when the task touches a repository / contract
+  (typically `.be` and `.shared`). For a pure `.web` UI task with no contract, they are N/A
+  and excluded — not auto-passed.
+- `SC-DONE-WHEN` and `SC-AC` apply to every task.
+- For `.e2e` tasks, `SC-AC` is satisfied by running the existing e2e suite green.
+
+## Threshold
+
+`all-pass` — every **applicable** criterion must PASS. One FAIL fails the dimension, and
+since this is the only enabled dimension by default, one FAIL fails the task. There is no
+partial credit and no halo effect: a beautiful, fast, working-90% build with one broken
+AC is a FAIL. This bluntness is intentional — it is the antidote to lenient self-grading.
+
+N/A criteria (e.g. contract criteria on a contractless UI task) are excluded from the
+denominator; they are never counted as PASS to pad the result.
+
+## Bug template
+
+```
+severity: [critical|major|minor]
+  critical = a Done-when or AC central to the feature does not work
+  major    = a secondary AC fails, or a contract field/error is mishandled
+  minor    = a non-go breach or layer leak with no user-visible effect (still a FAIL)
+criterion: [SC-AC | SC-DONE-WHEN | SC-REQ | SC-RES | SC-ERR | SC-NONGO | SC-LAYER]
+location: <file:line | endpoint | screen+element>
+repro: <exact steps or command that produced the evidence>
+expected: <quoted from the AC / Done-when / contract table>
+actual: <observed evidence: output excerpt, console error, or DB state>
+fix_hint: <optional — the wiring point the generator should look at>
+```
+
+## Probing notes specific to this dimension
+- Prefer driving the **running** app over reading code. The classic failure (from the
+  harness blog) is code that looks correct but whose wiring is broken with no surface
+  signal — only exercising it catches that.
+- When an AC's literal text is satisfied but behavior is not (a button exists but does
+  nothing), FAIL `SC-AC` and localize the dead wiring to file:line.
+- For `SC-DONE-WHEN`, reproduce the PO's described outcome end to end; a "Done when" is a
+  user-acceptance statement, so verify it as a user would.

package/skills/spec-evaluator/references/dimensions/tdd-surface.md

@@ -0,0 +1,110 @@
+---
+id: tdd-surface
+title: "TDD surface"
+enabled: true
+weight: 1.0
+hard_threshold: no-critical
+applies_to:
+  lens: [lite, standard]
+  package: any
+  variant: any
+requires_browser: false
+---
+
+# TDD Surface Dimension
+
+**Why this exists.** `spec-conformance` answers "does the built behavior match the spec?"
+It does not answer "did the build produce regressions, and is the new code actually tested?"
+An implementation can be spec-conformant and still fragile — passing all AC manually but
+having zero automated tests, or silently deleting tests that used to catch a class of bugs.
+This dimension adds the discipline layer: the evaluator refuses a PASS unless the test
+suite is green and new code carries test coverage.
+
+**TDD in this context** means: tests exist alongside production code, they actually run,
+they stay green after the change, and they exercise the AC behaviors — not just internal
+wiring. The classic failure mode is a PR that passes `pnpm typecheck` but deletes or
+skips the one test that would have caught the regression.
+
+**`.e2e` variant:** the e2e suite *is* the tests. TDD-2 (companion file check) is N/A
+and excluded from the denominator; TDD-1 (suite passes) still applies and is redundant
+with `SC-AC` — dual enforcement is intentional for e2e tasks.
+
+---
+
+## Criteria
+
+```yaml
+- id: TDD-1
+  statement: "The package test suite runs green — non-zero test count, no failing tests."
+  probe: cmd
+  evidence_required: true
+  pass_rule: >
+    Run `pnpm --filter <pkg> test` (or the equivalent runner for the package). The command
+    exits 0. The output shows ≥1 test executed (zero tests = no coverage = FAIL, not a skip).
+    Capture stdout + exit code as evidence. A suite that is skipped entirely or that has
+    no test files is a FAIL at `critical` — "tests pass" is vacuously true with no tests,
+    and that vacuous truth is worse than a failure.
+  source: task
+
+- id: TDD-2
+  statement: "Each new non-trivial source file introduced by this task has a companion test file."
+  probe: static
+  evidence_required: true
+  pass_rule: >
+    List all `.ts`/`.tsx` files added (not modified) by this task, excluding test files
+    themselves (`*.test.ts`, `*.spec.ts`, `__tests__/`), type-only files (`*.d.ts`), and
+    index/barrel files (`index.ts` whose sole content is re-exports). For each remaining
+    file, a companion test file must exist: either co-located (`foo.test.ts` next to `foo.ts`)
+    or in the package's test directory pointing at it. A new service or use-case with zero
+    test coverage → FAIL at `critical`. A new utility under 20 lines → FAIL at `major` (still
+    needs a test, just lower severity). Do not credit test files that were deleted or emptied
+    as part of this task.
+  source: code
+
+- id: TDD-3
+  statement: "Tests target AC behaviors, not just internal structure — each key AC scenario has a corresponding test case."
+  probe: static
+  evidence_required: false
+  pass_rule: >
+    Read the test files covering the task's new code. For each `[cmd]` or `[data]` AC that
+    passed spec-conformance, verify that a test case exercises that exact scenario (not just
+    that the function is imported). Tests that only call `expect(result).toBeDefined()` or
+    only test constructor/initialization do NOT count. A gap between AC scenarios and test
+    scenarios is a `minor` finding — advisory, does not fail the dimension. evidence_required
+    is false: a spec with no discoverable test gap simply yields no TDD-3 finding.
+  source: code
+```
+
+---
+
+## Threshold
+
+`no-critical` — TDD-1 (suite green) and TDD-2 (companion files) are `critical` FAILs:
+a build with no passing tests or no test coverage is not done regardless of how well it
+scores on `spec-conformance`. TDD-3 (AC-scenario alignment) is advisory (`minor`) and
+does not block — it is a quality signal for the generator, not a gating condition.
+
+---
+
+## Bug template
+
+```
+severity: [critical|major|minor]
+criterion: [TDD-1|TDD-2|TDD-3]
+location: <package path | file:line | test file path>
+repro: <command run — e.g. "pnpm --filter api test" | "find src/modules/canvas -name '*.ts' ! -name '*.test.ts'">
+expected: <e.g. "test suite passes with ≥1 test" | "companion test file for BoardService.ts">
+actual: <e.g. "exit code 1; 2 failing tests" | "no BoardService.test.ts found anywhere in packages/api/">
+fix_hint: <e.g. "add __tests__/BoardService.spec.ts; cover the createBoard and getBoard use cases">
+```
+
+## Probing notes
+
+- Run `pnpm --filter <pkg> test` (or `pnpm --filter <pkg> test:unit` if scripts are split).
+  Capture the full output. Most Jest/Vitest outputs emit `Tests: N passed` and an exit code.
+- For TDD-2, `git diff --name-only --diff-filter=A HEAD~1` (or the relevant base) lists
+  added files. Use `find <pkg>/src -name '*.ts'` if the git range is unclear; then diff
+  against `find <pkg>/src -name '*.test.ts' -o -name '*.spec.ts'` to spot uncovered modules.
+- Never skip TDD-1 because the test suite "probably hasn't changed." Always run it. Wiring
+  changes in one module routinely break tests in another — that is the exact regression
+  class this gate exists to catch.

package/skills/spec-evaluator/references/dimensions/test-surface-conformance.md

@@ -0,0 +1,100 @@
+---
+id: test-surface-conformance
+title: "Test surface conformance"
+enabled: false
+weight: 1.0
+hard_threshold: all-pass
+applies_to:
+  lens: [lite, standard]
+  package: any
+  variant: any
+requires_browser: true
+---
+
+# Test Surface Conformance Dimension
+
+> **Auto-enable rule (read at GATE V0.5):** stays `enabled: false` by default — a no-op on
+> every spec generated before `ba-pitch-analyzer` v2.9. The core flips it ON for a run
+> **only when** the spec's `usecases/` contains at least one `## Test Surface` section
+> (fresh v2.9 spec, or a pre-v2.9 spec retrofitted via a retrofit-surface order). Pre-surface
+> specs → never activates → existing verdicts unchanged (non-regression guarantee).
+> Explicit `--dimensions ...,test-surface-conformance` always wins over the auto rule.
+
+**Why this exists.** `spec-conformance` grades the AC that were written; it does not
+*expand* them. The QA meeting (2026-06-11) located the gap: nobody systematically derives
+the test matrix — boundary values, negative cases, error-code coverage, no-go breaches —
+that the spec already implies. The BA now derives that matrix into each UC's
+`## Test Surface` (D1 Invariants · D2 Error Cases · D3 Contract shapes · D4 No-gos,
+mechanical-only); this dimension is the judge-side half: probe every derived row against
+the running app. Judge probes; it never authors rows — a missing or thin Test Surface is
+reported as a finding and routed back to the planner's retrofit-surface operation, never filled in here.
+
+**Distinctions held:**
+- conformance = *the AC that were written pass* · test-surface = *the matrix the spec
+  implies passes* · completeness = *the tasks that must exist, do exist*.
+- This dimension covers **derivable** tests only. Exploratory edges (concurrency, state
+  interruption, cross-UC journeys, data residue) belong to `/qa-edge-hunter`, which runs
+  post-PASS and reads this run's `EVAL-*.md` as its negative-space input — every TS row
+  probed here is territory QA must NOT re-hunt. Recording probed rows in the report is
+  therefore part of this dimension's contract, not optional logging.
+
+---
+
+## Criteria
+
+- id: TSC-1
+  statement: "Every row in every UC `## Test Surface` table passes its Probe with the stated Expect, evidence captured."
+  probe: ui
+  evidence_required: true
+  pass_rule: >
+    For each TS-* row across usecases/: execute the Probe via the handler its phrasing
+    implies (API/data probes → cmd/data; screen-level → ui) and compare observed behavior
+    to Expect. Side-effect clauses ("no side effect", "state unchanged") MUST be verified
+    by a data probe, not assumed from the response code. Zero failing rows → PASS. Any
+    failing row → FAIL at `critical` (a derived case the spec itself implies is broken).
+    Rows whose probe cannot run (endpoint absent, screen unreachable) are FAILs, not skips
+    — absence of evidence is a FAIL.
+  source: code
+
+- id: TSC-2
+  statement: "The Test Surface is internally complete against its own sources: every [INV-NN] has a TS-INV-NN row; every Error Cases code has a TS-ERR-* row; rows cite D1–D4."
+  probe: static
+  evidence_required: true
+  pass_rule: >
+    Cross-check each UC: Invariants ↔ TS-INV rows, Error Cases codes ↔ TS-ERR rows, and
+    every row's Source cites D1–D4. A UC with `## Test Surface` whose own sources are
+    uncovered → FAIL at `major` with `next: retrofit-surface order (ba)` (judge surfaces the gap;
+    generator fills it — this dimension NEVER authors rows). A UC carrying the explicit
+    empty-sources line passes TSC-2 vacuously. A v2.9+ spec UC with NO `## Test Surface`
+    section at all → FAIL at `major`, same routing.
+  source: code
+
+---
+
+## Threshold
+
+`all-pass` — TSC-1 failures are correctness failures of behavior the spec itself derives;
+leniency here is leniency on the spec. TSC-2 `major` findings also block (the surface must
+be trustworthy before QA subtracts it as covered territory), but their fix is a planner
+retrofit-surface re-run, not a build round — the bug template's `next:` field routes them.
+
+---
+
+## Bug template
+
+```
+severity: [critical|major]
+criterion: [TSC-1|TSC-2]
+location: [usecases/UC-Name.md#Test-Surface TS-ID | endpoint | screen]
+ts_row: <the full row probed, verbatim>
+repro: <probe executed — command / UI steps>
+expected: <the Expect cell>
+actual: <observed evidence — response, state, screenshot ref>
+next: <TSC-1 → task-executor fix via tech-lead round r+1 | TSC-2 → retrofit-surface order re-run>
+```
+
+## Report obligation (the QA handoff)
+
+The EVAL report section for this dimension MUST list every TS row probed (PASS and FAIL),
+keyed `UC-id / TS-id`. `/qa-edge-hunter` Phase Q1 subtracts exactly this list when building
+charters — an unlisted probe is invisible to QA and will be wastefully re-hunted.

package/skills/spec-evaluator/references/probing.md

@@ -0,0 +1,177 @@
+# Probing (Phase A)
+
+How to collect evidence by criterion `probe` type and by task variant. Default to the
+running app over reading source.
+
+## Browser mode: prefer CLI over MCP
+For `[ui]` criteria, drive the browser via the Playwright **CLI**, not the MCP server, by
+default. The CLI saves accessibility snapshots as files on disk and the agent reads them
+on demand; MCP streams the full accessibility tree into context every step. The CLI path
+uses roughly 4x fewer tokens for the same work, and the Playwright team recommends it for
+coding agents specifically. Use `--browser mcp` only in a sandboxed environment where the
+CLI's filesystem access isn't available.
+
+Both paths read the browser's **accessibility tree**, not screenshots — structured
+role/label/state per element, no vision model needed. That is what makes the verdict
+localizable: a missing or dead element shows up as a tree node, then read the source to
+pin file:line.
+
+**Lazy preflight — run this check only when the spec actually contains a `[ui]` criterion,
+at the moment you reach the first one.** Playwright is NOT an install-time prerequisite of the
+harness; a run with no `[ui]` criteria must complete on a machine with no browser installed.
+
+```
+npx --no-install playwright --version || <missing>
+```
+
+If the CLI or the chromium binary is missing, FAIL the probe (not the whole run) with an
+actionable message that names the criterion that needed it and the fix:
+
+> `[ui]` criterion <UC/AC id> requires a browser to verify. Run `npx playwright install chromium`,
+> then re-run the eval. (For MCP mode, also `claude plugin install playwright@claude-plugins-official`.)
+
+Never auto-install a browser mid-eval, and never silently skip the criterion — a `[ui]` AC
+without a probe is a FAIL with reason "unverifiable: no browser", not a PASS.
+
+```
+The probe loop per [ui] criterion:
+  1. navigate to the screen under test
+  2. snapshot the accessibility tree → save to evaluation/.evidence/<task>-<crit>.txt
+  3. perform the action the criterion describes (click/type/submit)
+  4. snapshot again; diff state; capture any console error
+  5. record: element observed, state before/after, console output, and — if broken —
+     the source file:line where the handler/wiring fails
+```
+
+## Oracle dispatch (evaluation contract — Stage G)
+
+Each criterion / Test-Surface row carries an `oracle` tag — the dispatch key that declares *how*
+this criterion is verified. **Dispatch on it to choose the probe mechanism; default to `ui` when
+the tag is absent** (web pitches are unchanged). The single-judge invariant is untouched — one
+verdict per criterion, evidence-or-FAIL — the oracle changes only *how* evidence is gathered, never
+*who* decides.
+
+For every non-`ui` oracle you gather evidence by **running the deliverable yourself** (the Bash
+tool) and grading its *observed* output against the criterion's `expect`. Treat each criterion as a
+small declarative `{ id, desc, probe, expect }` row and grade it directly; never grep source in
+place of running it. A probe that throws, cannot spawn, or cannot reach the deliverable is a
+**FAIL** (absence of evidence), never a silent pass.
+
+| `oracle` | Deliverable | Probe procedure — run it, cite the observed output | Evidence to record |
+|---|---|---|---|
+| `ui` *(default)* | running web app | Playwright CLI loop (above) | a11y-tree node, state before/after, console |
+| `process` | CLI / script | spawn the binary with the criterion's `argv` in a **throwaway temp dir** (never the real cwd), seeded with any required store/fixture via env; read exit + stdout/stderr | exit code + stdout/stderr + crash check |
+| `test` | library / module | run the project's own test command; parse the summary line | suite exit + executed-test count + failing-test names |
+| `snapshot` | generator / pure refactor | run the deliverable, capture stdout, diff it against the agreed golden output | unified diff (empty = PASS) |
+| `http` | service / API | start the server on a free port, wait until it answers, send the request, assert; tear it down | status code + response body/JSON |
+
+**Per-oracle `probe`/`expect` shape (author it inline, one row per criterion):**
+- `process` — `probe: { argv, store }`, `expect: { exit, stdout, no_crash }`. Sandbox in a temp
+  dir + controlled env + a timeout so corrupted-input / missing-file probes cannot touch user data.
+- `test` — `probe: { cmd }`, `expect: { exit, min_tests, no_failures }`. **A suite that runs zero
+  tests is a FAIL** (matches TDD-1 below): a suite that runs nothing is not green.
+- `snapshot` — `probe: { argv }` + an agreed `golden` (normalize trailing whitespace + the final
+  newline so a benign EOL diff is not a false FAIL).
+- `http` — `server: { cmd, ready_path }` + `probe: { method, path, json }`, `expect: { status,
+  body, json }`. An unreachable server FAILs **every** criterion (a service you cannot reach does
+  not pass).
+
+**Shared `expect` grammar:** `exit`/`status` accept a number or a comparison string (`==0`, `!=0`,
+`>=200`, `<500`, or `*` = any); `stdout`/`stderr`/`body` accept `/regex/flags` matched against the
+observed output; `no_crash: true` requires no stack-trace/panic signature; `json` is a subset match
+on the parsed response body.
+
+The `ba` Test Surface emits the `oracle` per row; for a non-UI deliverable the rows are already
+tagged `process`/`test`/`snapshot`/`http`, so do not fall back to driving a browser that does not
+exist.
+
+## By probe type
+- `cmd` — run the command the AC implies (`pnpm --filter <pkg> test`, `pnpm typecheck`,
+  `curl` against a running endpoint, `migration up && migration down`). Capture stdout,
+  stderr, exit code. Non-zero exit or failing assertion = evidence of FAIL. (Backs the `test`,
+  `snapshot`, and `http` oracles.)
+- `ui` — Playwright CLI loop above. (Backs the `ui` oracle.)
+- `data` — query the DB / inspect storage after the action; capture the actual row/state
+  and compare to what the criterion expects.
+- `static` — read the diff / changed files (for `SC-NONGO`, `SC-LAYER`, secret scans,
+  TDD companion-file checks, integration test setup inspection). Use sparingly; never
+  substitute a code read for exercising behavior an AC describes.
+
+## TDD probing (for `tdd-surface` dimension)
+
+**TDD-1 (suite green):** Run `pnpm --filter <pkg> test` and capture the full output.
+Most Jest/Vitest runs emit something like `Tests: 4 passed, 0 failed` on the last line.
+Non-zero exit = FAIL. Zero tests executed = FAIL (a suite that runs nothing is not a green
+suite). Save the raw output to `evaluation/.evidence/<task>-TDD-1.txt`.
+
+**TDD-2 (companion files):** List files added by this task:
+```bash
+git diff --name-only --diff-filter=A HEAD~1  # files added; adjust base ref as needed
+```
+Filter to source files (`.ts`, `.tsx`) excluding `*.test.ts`, `*.spec.ts`, `*.d.ts`, and
+index/barrel-only files. For each remaining file, check whether a companion test file
+exists either co-located or in the package's `__tests__/` or `test/` directory:
+```bash
+# example check for a specific module
+find <pkg>/src -name 'BoardService.test.ts' -o -name 'BoardService.spec.ts'
+```
+Record the missing companions as evidence for TDD-2 FAILs.
+
+**TDD-3 (AC-scenario alignment, advisory):** Read the test file for the main new module.
+Look for test cases that match the AC scenario descriptions. Tests that only call
+`expect(result).toBeDefined()` or only exercise the constructor do not count.
+This is a static read; no running required. Record whether each key AC has a matching test.
+
+## Integration probing (for `integration` dimension)
+
+**Finding integration test files:** Check for files matching `*.integration.spec.ts`,
+`*.e2e-spec.ts`, or a top-level `test/` directory in the package. Also inspect
+`package.json` scripts for `test:e2e`, `test:int`, or `test:integration` targets.
+
+**INT-1 (no mocks):** After locating integration test files for the task's feature:
+```bash
+grep -rn "jest\.mock\|vi\.mock" <integration-test-file>
+```
+Mocking HTTP clients, email senders, or third-party APIs is acceptable. Mocking
+`PrismaClient`, a repository class, or the database connection defeats integration testing.
+Then run the integration suite: `pnpm --filter <pkg> test:e2e` (or equivalent). Capture
+exit code and test count.
+
+**INT-2 (auth boundary):** Locate the test case exercising the unauthorized path. Inspect
+its setup: it should create a different user's JWT (or use no auth) and assert a 403 or
+empty-set response. Capture the test body and the run output as evidence.
+
+**INT-3 (RLS-JWT pattern + pooler port):**
+```bash
+# Check for set_config call in test setup or helper
+grep -rn "set_config\|request\.jwt\.claims" <test-setup-files>
+
+# Check connection string in test env
+grep "DATABASE_URL" .env.test apps/api/.env.test
+```
+The `DATABASE_URL` must end with `:6543/...` (transaction-mode pooler). If no `.env.test`
+exists, check `jest.config.ts` or `globalSetup` for a `DATABASE_URL` override. A missing
+`set_config` call means queries run without RLS — false-positive auth passing silently.
+
+## By task variant
+- `.be` — no browser (`--browser none`). Start the API; send contract-shaped requests;
+  assert Response + Error tables; run the package test suite. Evidence = request/response
+  transcripts + test output.
+- `.shared` — usually `cmd` only: typecheck + unit tests on the shared package; verify
+  contract types compile and match the tables.
+- `.web` — Playwright CLI against the running web app for `SC-AC` and `SC-DONE-WHEN`.
+- `.mobile` — Playwright does not drive a native RN app. Options: probe via the platform's
+  e2e tool (Detox / Maestro) if present; otherwise mark the `[ui]` criteria `[manual]` at
+  GATE V1 and require an explicit user check (or `--strict` to FAIL them). Do not fake UI
+  evidence for native screens.
+- `.e2e` — run the existing end-to-end suite; green suite is the evidence for `SC-AC`.
+
+## App must be reachable before grading
+If the run command does not produce a reachable app, that is not "untestable" — it is a
+**FAIL** of every `[ui]`/`[data]` criterion under `NO EVIDENCE`, plus a critical bug:
+"app does not start with the stated run command." A build you cannot run does not pass.
+
+## Evidence storage
+Write raw evidence under `.shapeup/<slug>/evaluation/.evidence/` and reference it by path in the report.
+Keep the report itself readable; the evidence files are the audit trail the generator and
+the user can open.